DUSTTRAP
- ID
- S1159
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 21 Sep 2024
DUSTTRAP is a multi-stage plugin framework associated with APT41 operations with multiple components.[1]
Techniques used (29)
- T1005 Data from Local System
- T1010 Application Window Discovery
- T1012 Query Registry
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1027.009 Embedded Payloads
- T1027.013 Encrypted/Encoded File
- T1041 Exfiltration Over C2 Channel
- T1055 Process Injection
- T1056.001 Keylogging
- T1057 Process Discovery
- T1059.003 Windows Command Shell
- T1070 Indicator Removal
- T1070.005 Network Share Connection Removal
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087.001 Local Account
- T1087.002 Domain Account
- T1105 Ingress Tool Transfer
- T1113 Screen Capture
- T1124 System Time Discovery
- T1135 Network Share Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1482 Domain Trust Discovery
- T1497.001 System Checks
- T1518.001 Security Software Discovery
- T1615 Group Policy Discovery
- T1654 Log Enumeration
- T1685.005 Clear Windows Event Logs